Application No. 10/523,690 DocketNo.: 1560-0422PUS1 

Amendment dated January 5, 2010 

After Final Office Action of October 8, 2009 

AMENDMENTS TO THE CLAIMS 

1. (Currently Amended) A data processing method including receiving input data 
containing a plurality of instruction codes, and judging whether or not a process executed based 
on the instruction codes contained in the received data is a malicious process, said method 
comprising: 

retrieving an instruction code related to a branch instruction from the data; 
sequentially r eading one byte of the input dat a at a time ; 
determining whether or not the read data is a branch instruction; 

if the read input data is a branch instruction, determiningfo dging whether a branch 
destination address of the branch instructio n associated with a branch destination is larger than a 
branch origin address based only on the one byte of the data read and if the branch destination 
address is larger than the branch origin address storing the branch destination address and branch 
origin address ; 

storing th e branch origin address associated with th e r e tri e ved instruction cod e and the 
branch d e stination address associated with th e branch destination of the instruction code when 
the branch d e stination address associated with the branch destination is judged to be larger than 
the branch origin address; 

determining j udging whether or not a nthere is a call instruction cod e for calling an 
instruction code group for e x e cuting a pred e t e rmined process is associated with at the branch 
destination address ^, and storing a call destination address of the call instruction-eede if the 
instruction code is associated with at the branch destination address is a call instruction ; 
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1'udgin g detennining whether or not the stored call destination address is between the 
branch origin address and the branch destination address; and 

if the stored call destination address is between the branch origin address and the branch 
destination address concluding that th e process ex e cut e d bas e d on th e instruction codes 
contain e d in t he input data isincludes a malicious process , wh e n th e instruction code for calling 
th e instruction code group for e xecuting th e pr e det e rmined process is associat e d with th e branch 
d e stination address and the call d e stination address of th e instruction cod e is betwe e n the branch 
origin address and th e branch d e stination address . 



2. (Currently Amended) A data processor including means for receiving input data 
containing a plurality of instruction codes, for judgin g determining whether or not a process 
executed based on the instruction codes contained in the received data is a malicious process, 
said data processor comprising: 

m e ans for r e trieving an instruction cod e relat e d to a branch instruction from the data; 

means for sequentially r eading one byte of the input dat a at a time ; 

means for determining whether the read data is a branch instruction; 

if the read input data is a branch instruction determiningf adgmg whether a branch 
destination address of the branch instructio n associat e d with a branch d e stination is larger than a 
branch origin address based only on the one byte of the data read and if the branch destination 
address is larger than the branch origin address storing the branch destination address and the 
branch origin address ; 
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m e ans for storing the branch origin address associated with th e r e triev e d instruction cod e 
and the branch d e stination addr e ss associated with th e branch destination of the instruction cod e 
wh e n the branch d e stination addr e ss associated with th e branch destination is judg e d to be larg e r 
than th e branch origin addr e ss; 

means for judgin g determining whether or not there is a call a n-instructio n code for calling 
an instruction code group for e x e cuting a pr e d e t e rmined process is associat e d with atthe branch 
destination address ^, and m e ans for storing a call destination address of the call instruction-eede 
if the instruction code is associat e d with at the branch destination address is a call instruction ; and 

means for iudgin g determining whether or not the stored call destination address is 
between the branch origin address and the branch destination address ; and , wh e r e in 

if the stored call destination address is between the branch origin address and the branch 
destination address concluding it is conclud e d t hat ti 
codes contain e d in the input data ismcludes a malicious process? 
calling th e instruction cod e group for e xecuting th e pred e t e rmined proc e ss is associat e d with the 
branch destination addr e ss and th e call d e stination addr e ss of th e instruction cod e is b e tw e en th e 
branch origin addr e ss and th e branch d e stination addr e ss . 



3. (Currently Amended) The data processor as set forth in claim 2, further comprising 
means for judging whether or not a predetermined character string is associated with a return 
address of the instruction code group called by the call instruction , wherein if the predetermined 
character string is associated with the return address, the information indicating that the data is 
data for executing a malicious process is outputted. 
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4- 6. (Canceled) 

7. (Currently Amended) A computer-readable memory product storing a computer 
program including causing a computer to judge whether or not a process executed based on input 
data containing a plurality of instruction codes is a malicious process, the stored computer 
program comprising: 

causing th e comput e r to r e tri e v e an instruction code related to a branch instruction from 

causing the computer to sequentially read one byte of the input dat a at a time ; 

causing the computer to determine whether or not the read data is a branch instruction; 

if the read input data is branch instruction, causing the computer to judg edetermine 
whether a branch destination address of the branch instructio n associat e d with a branch 
destination is larger than a branch origin address based only on the one byte of the data rea d, and 
if the branch destination address is larger than the branch origin address causing the computer to 
store the branch destination address and branch origin address ; 

causing th e comput e r to stor e th e branch origin address associated with th e r e triev e d 
instruction cod e and th e branch d e stination address associat e d with th e branch destination of th e 
instruction cod e wh e n th e branch d e stination address associated with th e branch d e stination is 
judged to be larg e r than the branch origin addr e ss; 

causing the computer to judge -determine w hether or not a nthere is a call instruction-eede 
for calling an instruction cod e group for ex e cuting a pr e d e termin e d process is associated with at 
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the branch destination address^ 




and to store a call destination address of the 



call instruction-cede if the instruction code if 




lat the branch destination addressjs 



a call instruction ; 

causing the computer to judgedetenrrme whether or not the stored call destination address 
is between the branch origin address and the branch destination address; and 

if the stored call destination address is between the branch origin address and the branch 
destination address causing the computer to conclude that the proc e ss execut e d based on th e 



cod e for calling th e instruction cod e group for ex e cuting the predet e rmin e d proc e ss is associat e d 
with th e branch destination addr e ss and th e call d e stination address of th e instruction cod e is 
b e tween th e branch origin address and th e branch destination address . 

8. (Currently Amended) A data processor comprising: 

an input unit for inputting data containing a plurality of instruction codes; 

a storing unit for storing the data input by the input unit; and 

a controller capable of performing operations of; 

r e tri e ving an instruction code related to a branch instruction from the data stor e d 
in th e storing unit; 

sequentially reading one byte of the input dat a at a time ; 



destination address of the branch instructio n associat e d with a branch destination is larger than a 




-the input data ismdudes a malicious 




determining whether or not the read data is a branch instruction; 



if the read data is a branch instruction determiningf udgmg whether a branch 
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branch origin address based only on the one byte of the data rea d, and if the branch destination 
address is larger than the branch origin address storinfi the branch destination address and branch 
origin address ; 

storing th e branch origin address associat e d with th e retriev e d instruction cod e 
and th e branch d e stination address associat e d with the branch destination of the instruction code 
in th e storing unit when the branch d e stination addr e ss associated with the branch destination is 
judged to be larg e r than th e branch origin address; 

judgia gdetermining whether or not a nthere is a call instruction cod e for calling an 
instruction cod e group for e x e cuting a pr e determin e d proc e ss is associat e d with at the branch 
destination address ^ and storing a call destination address of the call instruction cod e in the 
storing unit if the instruction code is associat e d with at the branch destination address is a call 
instruction ; 

fadgift gdetermining whether or not the stored call destination address is between 
the branch origin address and the branch destination address; and 

if the stored call destination address is between the branch origin address and the 
branch destination address concluding that the process executed based on th e instruction cod e s 

th e instruction cod e group for e x e cuting the pr e det e rmined proc e ss is associat e d with th e branch 
d e stination addr e ss and th e call d e stination addr e ss of th e instruction cod e is b e tw ee n th e branch 
origin addr e ss and th e branch destination addr e ss . 
9-10. (Canceled) 
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1 1 . (Previously Presented) The data processing method according to claim 1 , wherein 
the malicious process causes an erroneous operation in the process executed based on the 
instruction codes contained in the received data. 
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